Summary
Once a vendor contract is signed, most of the risk work shifts to ongoing monitoring: reading the provider's reports, comparing them with what the bank has seen, and following up when the two don't line up. The 2023 interagency guidance says ongoing monitoring lets a bank "confirm the quality and sustainability of a third party's controls," and expects more frequent, more thorough monitoring for critical activities (Interagency Guidance on Third-Party Relationships). In practice, that means checking each vendor report against your own incident log and contract, logging every unresolved difference, and getting the evidence to close it.
For third-party risk, vendor management and operations teams at U.S. banks monitoring providers after onboarding.
What the guidance expects and what's bank practice
| Topic |
What applies |
Source |
| Ongoing monitoring |
Throughout the relationship, at a depth that matches the risk and complexity of the activity |
Interagency guidance |
| Critical activities |
More comprehensive or frequent monitoring |
Interagency guidance |
| Typical activities |
Reviewing performance reports, periodic meetings with the provider, and regular testing of the bank's own controls |
Interagency guidance |
| Escalation |
Significant issues such as material or repeat audit findings, deterioration in financial condition, security breaches and data loss |
Interagency guidance |
| Review frequency, exception register, evidence requests |
Not set by the guidance; the bank decides these based on risk |
Bank procedures |
The guidance is supervisory guidance, not a regulation, and the OCC issued it as Bulletin 2023-17. The agencies proposed replacement guidance in September 2026 (OCC Bulletin 2026-46), but until it's final, the 2023 guidance applies.
Monitor a provider in six steps
1. Confirm what you're monitoring
Record the legal entity you contract with, the services you actually use, the risk tier and the review period. Then compare that with the last assessment. Assessments often go stale quietly: the bank adds a new service, or the provider changes its business, and the report on file no longer covers what the bank relies on. The guidance specifically lists changes to a provider's business strategy and agreements as factors to watch.
2. Know what each report actually measures
Before comparing anything, write down what each source counts. A provider's monthly report might count only platform-wide outages, while your incident log records every failed file delivery. Both can be accurate and still disagree. Check the definitions in the report and the fields in your log so you're comparing the same events.
3. Compare the provider's reports with your own records
Line up the provider's performance reports, control assessments and status updates against your incident log, service-level terms and issue register. For each of your observations, find the provider statement that covers it and note whether they match, cover different periods, cover different services or still conflict.
One matching pair doesn't prove the controls work. The guidance asks banks to confirm controls hold up over time, which means looking at the pattern across review cycles.
4. Log each unresolved difference
Keep an exception register with one row per open item: the service, the period, the two sources, the difference, what neither source shows, the evidence requested, who's following up and the due date.
Escalate right away when a source shows one of the significant issues the guidance names, such as a security breach, data loss or a repeat audit finding.
5. Request specific evidence
Ask for the exact record, period and service that would resolve each item, such as incident records for September or an assessment covering the new service. A general request usually gets the same general report back. Send contract questions, like whether an outage breached a service level, to legal.
6. Close items on review, not on receipt
An exception closes when the risk reviewer has read the evidence and decided it resolves the difference. A document arriving isn't the same thing. Then set the next review date by risk tier, with critical providers reviewed more often.
Worked example
Illustrative example. All names and figures are fictional.
A bank has 14 active vendor relationships. Its policy calls for quarterly reviews of its 3 critical providers and annual reviews of the other 11, which comes to 23 reviews a year (3 × 4 + 11 × 1). The quarterly frequency is the bank's own choice, not a regulatory minimum.
In September, the bank reviews Example Vendor Co., a critical provider of document transfer and processing, and logs three exceptions.
| Exception |
What the sources show |
Evidence requested |
| Definition |
The vendor's report shows no outages, but it only counts platform-wide events. The bank's log shows 2 failed file deliveries that delayed processing. |
Event records for both failures and the service-level definition; contract question sent to legal |
| Scope |
The vendor's control assessment covers the processing service through June. The bank started using the transfer service in August. |
An assessment covering the transfer service and the current period |
| Remediation |
The vendor marked the file-delivery issue fixed after a configuration change but sent no test results. The bank's issue register still lists it as open. |
The change record and test evidence |
None of the three closes until the risk reviewer has the evidence and decides it answers the question.
Where vendor monitoring goes wrong
The most common problem is relying on the provider's own reports without checking them against anything the bank holds. Another is comparing numbers that count different things and treating the gap as either a breach or a non-issue without asking. Assessments that don't cover a newly added service often go unnoticed until something fails. And exceptions tend to close when a vendor sends a document, before anyone has confirmed it answers the question, which leaves the register looking cleaner than the relationship is.
How Bretton fits in
Third-party and vendor risk is one of Bretton's use cases, covering assessment at onboarding and reassessment on a schedule (Bretton platform). Bretton's agents gather the provider's reports and the bank's own records, apply your policy and draft the findings for your team to approve, working with the systems you already use. Every action is logged and cited, so a reviewer can see which document each finding came from before deciding whether an exception closes.
Common questions
How often should a bank review its third-party providers?
The guidance doesn't set a frequency. It expects monitoring to match the risk of the activity, with more frequent and thorough reviews for critical providers. Each bank sets its own schedule by risk tier in its procedures.
What does ongoing monitoring of a third party include?
The guidance gives examples: reviewing the provider's performance reports, periodic meetings with the provider, and regular testing of the bank's own controls. Significant issues, such as security breaches or repeat audit findings, should be escalated.
Does outsourcing an activity move the risk to the vendor?
No. The interagency guidance says a bank's use of third parties doesn't diminish its responsibility to operate safely and comply with the law, just as if it did the work itself.
Sources
- Federal Reserve, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, June 2023
- OCC, Bulletin 2023-17, June 6, 2023
- OCC, Bulletin 2026-46: Third-Party Risk Management, Proposed Guidance, September 11, 2026
- Bretton, Platform
Book a demo to see how Bretton prepares third-party risk reviews for your team.
